CVE-2026-80887 drm/vmwgfx: use check_add_overflow for shader size+offset bound
Integer overflow in vmwgfx driver allows bypassing bounds checks, potentially leading to privilege escalation or code execution via crafted shader offsets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80887?
CVE-2026-80887 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use check_add_overflow for shader size+offset bound
vmw_shader_define() validates the user-supplied shader window against its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands.
Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
Which versions are affected by CVE-2026-80887?
How do I fix CVE-2026-80887?
Apply the vendor's patch.
Is CVE-2026-80887 being exploited?
There is no known exploitation of CVE-2026-80887 in the wild and no public exploit code.
Sources
Also known as AZL-99603, BELL-CVE-2026-80887, DEBIAN-CVE-2026-80887, GHSA-377r-p949-gf93, UBUNTU-CVE-2026-80887.